CySEC and Data-Driven Supervision: How AI and SupTech Really Fit In
Financial regulators across Europe are investing in technology to keep pace with faster, more complex and increasingly digital markets, and the Cyprus Securities and Exchange Commission (CySEC) is no exception. Recent coverage has suggested the regulator has switched on a sweeping "AI-driven surveillance system" to police the market in real time. The reality is more measured: CySEC has publicly committed to investing in data analytics, artificial intelligence and cybersecurity as part of a broader modernisation of its supervision, but it has not announced a single named surveillance product, and the direction is shaped as much by EU-wide frameworks as by anything unique to Cyprus.
What CySEC has actually said
In its review of 2025 activity and priorities for 2026, CySEC reported approximately 600 on-site and off-site inspections of investment firms, fund managers, issuers and market infrastructures, alongside around €2.3 million in administrative penalties. Digital transformation featured prominently: the Commission said it is investing in IT systems, artificial intelligence and cybersecurity tools, with plans to strengthen its workforce in 2026. The framing from the regulator is that technology helps supervisors identify risks earlier and respond more efficiently – an enabler of human oversight, not a finished, autonomous "robo-regulator".
The building blocks already in place
CySEC's engagement with regulatory and supervisory technology is not new. It announced a FinTech and RegTech Innovation Hub in July 2018, giving firms working on new technologies a channel to discuss regulatory expectations with its staff. In June 2024 it went further, launching a Regulatory Sandbox – a controlled, supervised environment in which eligible firms can test FinTech, RegTech and SupTech solutions and receive non-binding feedback before going to market. These initiatives are where genuinely novel tools, including AI-based ones, are assessed.
The EU framework doing the heavy lifting
Much of the momentum comes from the European level. Under its Data Strategy 2023-2028, the European Securities and Markets Authority (ESMA) has set out to become a reference point on RegTech and SupTech for national regulators such as CySEC, arguing that big-data and AI techniques increase authorities' ability to analyse the information they collect and to run "data-driven supervision". ESMA's 2025 guidelines on preventing and detecting market abuse under the Markets in Crypto-Assets Regulation (MiCA) explicitly reference data-driven surveillance, drawing on public and private data and analytical techniques to spot weak signals. Separately, the EU's Digital Operational Resilience Act (DORA), which applies to financial entities from January 2025, obliges CySEC-supervised firms to strengthen their own cyber-resilience – another driver behind the regulator's technology spending.
What to treat with caution
Several specific claims circulating about CySEC do not stand up. There is no publicly documented launch of a branded "AI surveillance platform", "AI risk-assessment platform" or "Sandbox 2.0", and no official basis for describing Cyprus as "leading the EU" in AI-driven oversight. CySEC's own statements describe investment and intent, not a deployed, named system, and much of the surveillance architecture for cross-border markets sits with ESMA and the wider network of national regulators rather than with any single country.
The accurate picture is one of steady modernisation. CySEC is building data and AI capability into its supervision, using its Innovation Hub and Regulatory Sandbox to engage with new tools, and aligning with EU frameworks that increasingly expect data-driven oversight. That matters for firms operating in Cyprus – better data tends to mean earlier questions from the regulator – but it is evolution within a European system, not a revolution unique to the island.